https://rawsoft.com/blog Analytics, tracking and privacy engineering from Rawsoft. en-us Sun, 20 Sep 2026 12:00:00 +0000 https://rawsoft.com/blog/a-perfect-privacy-score-is-not-a-clean-site https://rawsoft.com/blog/a-perfect-privacy-score-is-not-a-clean-site Sun, 20 Sep 2026 12:00:00 +0000 50 of 47,419 scored websites got a perfect privacy score. We published none of them. Why a clean scan result is the one worth questioning, and what to ask of any report that hands you one. https://rawsoft.com/blog/a-preferences-link-is-not-a-consent-gate https://rawsoft.com/blog/a-preferences-link-is-not-a-consent-gate Sun, 20 Sep 2026 12:00:00 +0000 Ecommerce posted the best average privacy score in our index at 24.0, yet only 14 of 8,386 sites reached the Gated tier. Most had a preferences link and no consent platform detected. A link and a gate are not the same thing. https://rawsoft.com/blog/consent-banner-acceptance-test https://rawsoft.com/blog/consent-banner-acceptance-test Sun, 20 Sep 2026 12:00:00 +0000 Of 1,475 sites with a consent platform detected, 239 reached the Gated tier. The other 1,236 did not. Here is why "the banner shows up" is the wrong acceptance test, and the three checks that replace it. https://rawsoft.com/blog/consent-debate-wrong-denominator https://rawsoft.com/blog/consent-debate-wrong-denominator Sun, 20 Sep 2026 12:00:00 +0000 Every argument about cookie banner design assumes a banner exists. On 47,419 scored public websites, a consent platform was detected on 1,475 of them. The other 96.9% had none at all. Here is what that does to the question everyone is asking. https://rawsoft.com/blog/consent-mode-is-a-measurement-problem https://rawsoft.com/blog/consent-mode-is-a-measurement-problem Sun, 20 Sep 2026 12:00:00 +0000 Only 4.4% of scanned sites send a working Consent Mode v2 signal. The compliance reading of that is familiar. The advertising reading is not: without the signal there is no gap for Google to model, so the reporting looks clean whether or not anyone is being counted. https://rawsoft.com/blog/consent-mode-signal-not-transmitted https://rawsoft.com/blog/consent-mode-signal-not-transmitted Sun, 20 Sep 2026 12:00:00 +0000 Of 47,419 sites scored, 23,307 run Google tags and send no consent signal at all. Only 2,108 show a working Consent Mode v2 signal. The common failure is not a misconfigured signal, it is no signal, and nothing about it looks broken. https://rawsoft.com/blog/consent-platform-market-share-2026 https://rawsoft.com/blog/consent-platform-market-share-2026 Sun, 20 Sep 2026 12:00:00 +0000 Across 47,419 scored sites a consent platform was detected on 1,475, and a vendor could be named on 1,109 of them. Here is the full ranking, and why the name on the banner tells you almost nothing about whether consent works. https://rawsoft.com/blog/correlated-alerts-are-one-incident https://rawsoft.com/blog/correlated-alerts-are-one-incident Sun, 20 Sep 2026 12:00:00 +0000 Nine alarms arrived from one property inside the same minute, one per metric. That is one incident reported nine times, and the correlation, which is the most useful fact in the whole thing, gets discarded at exactly the moment it is cheapest to compute. https://rawsoft.com/blog/detected-is-not-the-same-as-present https://rawsoft.com/blog/detected-is-not-the-same-as-present Sun, 20 Sep 2026 12:00:00 +0000 Our own privacy scanner reported no consent platform on two sites that plainly had one. Both were client-side apps whose tags load after hydration. "None detected" is a claim a tool makes about its own eyesight, and it gets stored in the same field as a real absence. https://rawsoft.com/blog/gated-is-not-compliant https://rawsoft.com/blog/gated-is-not-compliant Sun, 20 Sep 2026 12:00:00 +0000 Only 0.5% of 47,419 scored websites gate their tags behind a consent decision. "Compliant" is a legal conclusion nobody selling software can hand you. "Gated" is an observable fact about a page. Here is the difference, and the four-minute check. https://rawsoft.com/blog/google-tag-becomes-a-container https://rawsoft.com/blog/google-tag-becomes-a-container Sun, 20 Sep 2026 12:00:00 +0000 Google is upgrading standalone Google tags into full Tag Manager containers, and the new deployment snippet no longer carries the gtag config command. Initialization moves to a trigger. That is a change in order of operations, and order of operations is where consent defaults live. https://rawsoft.com/blog/google-tag-migration-consent-signal https://rawsoft.com/blog/google-tag-migration-consent-signal Sun, 20 Sep 2026 12:00:00 +0000 Google is replacing the GA4 Configuration tag with the Google tag in Tag Manager. It is being read as a rename. It is a shared configuration surface, and it lands on a web where half the sites running Google tags send no consent signal at all. https://rawsoft.com/blog/more-sites-signal-than-own-a-platform https://rawsoft.com/blog/more-sites-signal-than-own-a-platform Sun, 20 Sep 2026 12:00:00 +0000 On 47,419 scored websites, 1,475 had a consent platform detected and 2,108 sent a working Consent Mode v2 signal. The number doing it correctly is larger than the number that bought a tool to do it. The platform was never the mechanism. https://rawsoft.com/blog/nobody-owns-the-consent-wire https://rawsoft.com/blog/nobody-owns-the-consent-wire Sun, 20 Sep 2026 12:00:00 +0000 On 47,419 scored sites, 23,307 run Google tags with no Consent Mode signal and 2,108 send a working one. Roughly eleven to one. The reason is not difficulty. It is that the privacy team owns the decline and the media team owns the reporting, and the setting between them belongs to neither. https://rawsoft.com/blog/privacy-scores-have-no-middle https://rawsoft.com/blog/privacy-scores-have-no-middle Sun, 20 Sep 2026 12:00:00 +0000 In an index of 47,419 scored sites, 96.8% scored under 30 and 1.2% scored 80 or over. Only 2.1% landed anywhere in between. Here is why the middle is empty, and what that means if you are halfway through a consent project. https://rawsoft.com/blog/strictly-necessary-is-not-your-decision https://rawsoft.com/blog/strictly-necessary-is-not-your-decision Sun, 20 Sep 2026 12:00:00 +0000 A hosted platform told us its analytics cookie was strictly necessary and produced a processor agreement to back it up. Both statements were probably true. Neither one touches the test, and the brand whose customers loaded that page is the one holding the question. https://rawsoft.com/blog/the-consent-banner-nobody-owns https://rawsoft.com/blog/the-consent-banner-nobody-owns Sun, 20 Sep 2026 12:00:00 +0000 Of 47,419 sites scored, 1,475 had a consent platform detected and only 1,109 carried a vendor we could name. The hand-built banner is a real category, and it has a failure profile a purchased one does not. https://rawsoft.com/blog/the-n-and-the-window https://rawsoft.com/blog/the-n-and-the-window Sun, 20 Sep 2026 12:00:00 +0000 Most privacy and tracking statistics circulate with no sample size and no collection window. Both omissions make a number impossible to check, reproduce or compare. Here is the four-second test, and what it costs to publish figures that can be found out. https://rawsoft.com/blog/trackers-outside-the-tag-manager https://rawsoft.com/blog/trackers-outside-the-tag-manager Sun, 20 Sep 2026 12:00:00 +0000 A consent platform can only block what routes through it. Hardcoded template scripts, vendor SDKs that load other SDKs, and platform-injected pixels never do. Here is how to find the ones your tag manager cannot see. https://rawsoft.com/blog/visual-tagging-second-primary-conversion https://rawsoft.com/blog/visual-tagging-second-primary-conversion Sun, 20 Sep 2026 12:00:00 +0000 Google Ads Visual Tagging lets anyone create a conversion by clicking a page element. On an account that already tracks purchases, that is how a second primary conversion appears, and Smart Bidding optimises toward the inflated number without anything looking broken. https://rawsoft.com/blog/what-regulators-can-actually-check https://rawsoft.com/blog/what-regulators-can-actually-check Sun, 20 Sep 2026 12:00:00 +0000 California's new CCPA regulations split into a documentary half nobody outside the company can verify and a technical half anyone can verify in about ten seconds. On 47,419 scored websites, 49.2% ran Google tags with no Consent Mode signal at all. The observable half is where the gap is. https://rawsoft.com/blog/why-thousands-of-sites-score-zero https://rawsoft.com/blog/why-thousands-of-sites-score-zero Sun, 20 Sep 2026 12:00:00 +0000 We scored 47,419 websites for privacy practice and 18,550 came back at zero out of 100. Here is what a zero actually indicates, why the distribution piles at the bottom, and three checks you can run on your own site in ten minutes. https://rawsoft.com/blog/banners-that-do-not-block https://rawsoft.com/blog/banners-that-do-not-block Sat, 29 Aug 2026 12:00:00 +0000 Of 47,419 sites we scored, 1,475 showed a cookie banner and 620 of those tracked the visitor anyway. The problem is not the sites with no consent tooling. It is the ones that bought it, deployed it, and are protected by none of it. https://rawsoft.com/blog/state-is-not-history https://rawsoft.com/blog/state-is-not-history Sat, 29 Aug 2026 12:00:00 +0000 Our scan chart showed fewer domains for August 23 than we recorded on August 23. Nothing was deleted. A store keyed by identity rewrites its own past every time a row is updated, and most dashboards never notice. https://rawsoft.com/blog/why-restaurant-websites-score-worst-on-privacy https://rawsoft.com/blog/why-restaurant-websites-score-worst-on-privacy Sat, 29 Aug 2026 12:00:00 +0000 Across 47,419 scored sites, restaurants averaged 9.9 out of 100 on privacy and ecommerce averaged 24.0. The gap is not effort. It is how much of a restaurant funnel runs on domains the brand does not own. https://rawsoft.com/blog/correlated-alerts-one-source https://rawsoft.com/blog/correlated-alerts-one-source Mon, 24 Aug 2026 12:00:00 +0000 When every metric on one dataset breaches in the same minute, that is one infrastructure failure, not seven business problems. Per-metric alerting cannot say so, which is why it arrives as noise. https://rawsoft.com/blog/mixed-date-records https://rawsoft.com/blog/mixed-date-records Mon, 24 Aug 2026 12:00:00 +0000 A record stamped with today's date can be mostly months old. Partial updates rewrite the timestamp but not the fields, and the row that results passes every data quality check while quietly destroying period-over-period comparison. https://rawsoft.com/blog/monitoring-the-monitor https://rawsoft.com/blog/monitoring-the-monitor Mon, 24 Aug 2026 12:00:00 +0000 Alerting systems fail silently by construction, because the thing that would report the failure is the thing that failed. A quiet week and a dead monitor look identical. Heartbeats fix what more alarms cannot. https://rawsoft.com/blog/google-ads-target-enforcement-august-2026 https://rawsoft.com/blog/google-ads-target-enforcement-august-2026 Thu, 20 Aug 2026 12:00:00 +0000 On August 17, Google began steering budget-limited campaigns toward their stated CPA and ROAS targets instead of beating them. Costs per conversion will rise on a date nobody chose. Here is how to tell an enforcement-driven increase from a real performance problem. https://rawsoft.com/blog/restaurant-website-vendor-sprawl https://rawsoft.com/blog/restaurant-website-vendor-sprawl Thu, 20 Aug 2026 12:00:00 +0000 A typical restaurant chain site hands visitors to an ordering platform, a loyalty program, a gift card processor and a catering system, each on different code and different domains. Here is what that sprawl does to tracking, attribution and privacy compliance, and how to govern it. https://rawsoft.com/blog/website-change-log-provenance https://rawsoft.com/blog/website-change-log-provenance Thu, 20 Aug 2026 12:00:00 +0000 Change history for a website is scattered across a tag manager, a CMP panel, a CMS and a vendor's ticket queue, none of which was built to answer "what changed, when, and why." The question always arrives eventually, and the hardest version asks about a past date. https://rawsoft.com/blog/zero-versus-missing-analytics https://rawsoft.com/blog/zero-versus-missing-analytics Thu, 20 Aug 2026 12:00:00 +0000 A zero on a report means one of two completely different things: nothing happened, or nothing was measured. Most analytics setups cannot tell you which, and the gap is where broken tracking hides for months. https://rawsoft.com/blog/api-retirement-stale-dashboards https://rawsoft.com/blog/api-retirement-stale-dashboards Thu, 13 Aug 2026 12:00:00 +0000 When a vendor retires an API, nothing goes dark. Dashboards freeze instead, rendering last week's numbers next to today's date. Here is the inventory-and-freshness playbook for surviving any vendor end-of-life without finding out from a bad decision. https://rawsoft.com/blog/consent-gap-international-domains https://rawsoft.com/blog/consent-gap-international-domains Thu, 13 Aug 2026 12:00:00 +0000 Your flagship domain has a CMP and passes review. Your regional site, built by a different team on a different stack, has no Consent Mode at all. Here is the 10-minute inventory that finds the gap and the fix order that closes it. https://rawsoft.com/blog/consent-does-not-cross-domain-boundaries https://rawsoft.com/blog/consent-does-not-cross-domain-boundaries Tue, 04 Aug 2026 12:00:00 +0000 If your transaction flow runs on a vendor's domain, the consent your banner captured cannot be read there. Here is why that happens, why the domain does not decide who is responsible, and how to check your own site in two minutes. https://rawsoft.com/blog/gtm-default-workspace-publish-risk https://rawsoft.com/blog/gtm-default-workspace-publish-risk Tue, 04 Aug 2026 12:00:00 +0000 Standard GTM containers allow only three concurrent workspaces. When they're full, urgent fixes land in the Default Workspace, and publishing a workspace publishes everything in it, not just your change. https://rawsoft.com/blog/what-your-page-paths-tell-your-pixels https://rawsoft.com/blog/what-your-page-paths-tell-your-pixels Tue, 04 Aug 2026 12:00:00 +0000 A new FTC complaint describes two ways sensitive data reached ad platforms. One was a deliberate upload. The other was a pixel doing its default job. Here is how to audit the second one on your own site. https://rawsoft.com/blog/extract-dashboard-filters-before-you-rebuild https://rawsoft.com/blog/extract-dashboard-filters-before-you-rebuild Sat, 25 Jul 2026 12:00:00 +0000 A dashboard's numbers depend on filter rules hidden in the report builder and on derived fields defined elsewhere. Here's why every BI migration needs a filter extraction first, and how to do it. https://rawsoft.com/blog/meta-off-meta-opt-out-removal https://rawsoft.com/blog/meta-off-meta-opt-out-removal Sat, 25 Jul 2026 12:00:00 +0000 Meta is retiring the user-level "activity off Meta" opt-out this month. Here's what changes for advertisers, why your audiences will grow, and the one control that still works. https://rawsoft.com/blog/privacy-enforcement-comes-down-to-the-opt-out https://rawsoft.com/blog/privacy-enforcement-comes-down-to-the-opt-out Sat, 25 Jul 2026 12:00:00 +0000 US state privacy enforcement hasn't hinged on missing policies or big data breaches. It keeps coming back to one thing: the opt-out. Broken "Do Not Sell" links, ignored GPC signals, and consent UIs that make declining harder than accepting. https://rawsoft.com/blog/cookie-banner-vs-consent-tool https://rawsoft.com/blog/cookie-banner-vs-consent-tool Tue, 14 Jul 2026 12:00:00 +0000 A banner is a UI. A consent tool is enforcement. The three banner types we see in audits, a two-minute Global Privacy Control test, and the state-by-state reason the implied-consent notice no longer holds. https://rawsoft.com/blog/google-ads-attribution-models-removed-2026 https://rawsoft.com/blog/google-ads-attribution-models-removed-2026 Tue, 14 Jul 2026 12:00:00 +0000 Google removed first click, linear, time decay, and position-based attribution from Google Ads in July 2026. What changed, whose numbers move, and the 15-minute conversion action check to run before your August reports lie to you. https://rawsoft.com/blog/meta-conversions-api https://rawsoft.com/blog/meta-conversions-api Wed, 01 Jul 2026 12:00:00 +0000 The Meta Conversions API recovers conversion signal lost to ad blockers, ITP, and consent - but only if you deduplicate and forward standard events. Here's how CAPI really works. https://rawsoft.com/blog/standard-vs-custom-events https://rawsoft.com/blog/standard-vs-custom-events Wed, 01 Jul 2026 12:00:00 +0000 Firing custom events instead of Meta/TikTok standard events silently caps campaign performance. Here's why - and how to audit your Events Manager. https://rawsoft.com/blog/gtm-google-tag-migration https://rawsoft.com/blog/gtm-google-tag-migration Mon, 22 Jun 2026 12:00:00 +0000 Google is auto-migrating the GA4 Configuration Tag to the Google Tag with Destinations. What actually changes, the dual-ID deployment model, a pre-upgrade audit, what to test in staging, and a rollback plan. https://rawsoft.com/blog/consent-banner-blocking https://rawsoft.com/blog/consent-banner-blocking Wed, 01 Apr 2026 12:00:00 +0000 We audit 10-15 sites a week. In more than half, the banner looks great but zero scripts are actually being gated. Here's how to check yours in 5 minutes. https://rawsoft.com/blog/conversion-tracking-broken https://rawsoft.com/blog/conversion-tracking-broken Wed, 01 Apr 2026 12:00:00 +0000 Your campaigns look busy but the data feeding them is broken. Here are the five patterns we see in every audit that signal your tracking needs immediate attention. https://rawsoft.com/blog/ga4-audit-checklist https://rawsoft.com/blog/ga4-audit-checklist Wed, 01 Apr 2026 12:00:00 +0000 Everything we check when auditing a GA4 implementation. From data layer architecture to conversion configuration to consent mode verification. 40+ checkpoints. https://rawsoft.com/blog/ga4-google-ads-mismatch https://rawsoft.com/blog/ga4-google-ads-mismatch Wed, 01 Apr 2026 12:00:00 +0000 Your client asks every month why GA4 and Google Ads show different numbers. The answer is almost always conversion configuration, not attribution differences. https://rawsoft.com/blog/server-side-tagging-worth-it https://rawsoft.com/blog/server-side-tagging-worth-it Wed, 01 Apr 2026 12:00:00 +0000 Client-side cookies are dying. But server-side tagging isn't free. We break down the real costs, benefits, and when it actually makes sense for your business.